experimental repro for #147

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>

Author: fredbi

middleware/route_authenticator_test.go

@@ -14,6 +14,10 @@ import (
 	"github.com/go-openapi/runtime"
 )
 
+type principalType struct {
+	Name string
+}
+
 type countAuthenticator struct {
 	count     int
 	applies   bool
@@ -40,18 +44,28 @@ var (
 	noApplyAuth = runtime.AuthenticatorFunc(func(_ any) (bool, any, error) {
 		return false, nil, nil
 	})
+	successAuthWithPointer = runtime.AuthenticatorFunc(func(_ interface{}) (bool, interface{}, error) {
+		return true, &principalType{Name: "the user"}, nil
+	})
+	failAuthWithPointer = runtime.AuthenticatorFunc(func(_ interface{}) (bool, interface{}, error) {
+		var typedPrincipal *principalType
+		return true, typedPrincipal, errors.New("unauthenticated")
+	})
+	failAuthWithNilPointer = runtime.AuthenticatorFunc(func(_ interface{}) (bool, interface{}, error) {
+		var typedPrincipal *principalType
+		return true, typedPrincipal, nil
+	})
 )
 
 func TestAuthenticateSingle(t *testing.T) {
 	ra := RouteAuthenticator{
 		Authenticator: map[string]runtime.Authenticator{
-			"auth1": successAuth,
+			"auth1": successAuthWithPointer,
 		},
 		Schemes: []string{"auth1"},
 		Scopes:  map[string][]string{"auth1": nil},
 	}
 	ras := RouteAuthenticators([]RouteAuthenticator{ra})
-
 	require.FalseT(t, ras.AllowsAnonymous())
 
 	req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil)
@@ -64,6 +78,68 @@ func TestAuthenticateSingle(t *testing.T) {
 	require.Equal(t, ra, *route.Authenticator)
 }
 
+func TestAuthenticateWrong(t *testing.T) {
+	t.Run("with principal as a pointer to a concrete type", func(t *testing.T) {
+		t.Run("should authenticate", func(t *testing.T) {
+			ra := RouteAuthenticator{
+				Authenticator: map[string]runtime.Authenticator{
+					"auth1": successAuthWithPointer,
+				},
+				Schemes: []string{"auth1"},
+				Scopes:  map[string][]string{"auth1": nil},
+			}
+			ras := RouteAuthenticators([]RouteAuthenticator{ra})
+
+			require.False(t, ras.AllowsAnonymous())
+
+			req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil)
+			route := &MatchedRoute{}
+			ok, prin, err := ras.Authenticate(req, route)
+			require.NoError(t, err)
+			require.True(t, ok)
+			require.EqualValues(t, &principalType{Name: "the user"}, prin)
+		})
+		t.Run("should not authenticate", func(t *testing.T) {
+			ra := RouteAuthenticator{
+				Authenticator: map[string]runtime.Authenticator{
+					"auth1": failAuthWithPointer,
+				},
+				Schemes: []string{"auth1"},
+				Scopes:  map[string][]string{"auth1": nil},
+			}
+			ras := RouteAuthenticators([]RouteAuthenticator{ra})
+
+			require.False(t, ras.AllowsAnonymous())
+
+			req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil)
+			route := &MatchedRoute{}
+			ok, prin, err := ras.Authenticate(req, route)
+			require.Error(t, err)
+			require.True(t, ok)
+			require.Nil(t, prin)
+		})
+		t.Run("should yield nil principal", func(t *testing.T) {
+			ra := RouteAuthenticator{
+				Authenticator: map[string]runtime.Authenticator{
+					"auth1": failAuthWithNilPointer,
+				},
+				Schemes: []string{"auth1"},
+				Scopes:  map[string][]string{"auth1": nil},
+			}
+			ras := RouteAuthenticators([]RouteAuthenticator{ra})
+
+			require.False(t, ras.AllowsAnonymous())
+
+			req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil)
+			route := &MatchedRoute{}
+			ok, prin, err := ras.Authenticate(req, route)
+			require.NoError(t, err)
+			require.True(t, ok)
+			require.Nil(t, prin)
+		})
+	})
+}
+
 func TestAuthenticateLogicalOr(t *testing.T) {
 	ra1 := RouteAuthenticator{
 		Authenticator: map[string]runtime.Authenticator{